@0x0501/mystack 0.0.0-stage → 0.1.0-bootstrap.0

package/template/src/lib/user-update-guard.ts

@@ -0,0 +1,35 @@
+/**
+ * The `user.update.before` guard for server-controlled columns.
+ *
+ * Better Auth **merges** a before-hook's result over the original data
+ * (`actualData = { ...actualData, ...result.data }`), so omitting a key leaves
+ * the caller's value in place. Strip-based defences silently no-op.
+ *
+ * So this refuses instead. No legitimate client sends these on an update.
+ * Admin/plugin writes that must set role or ban go through `auth.api.*` admin
+ * endpoints or drizzle, which do not run this hook the same way (or use
+ * dedicated admin APIs).
+ */
+import { APIError } from "better-auth";
+
+/** Server-controlled: never settable through the member update-user API. */
+const PROTECTED_FIELDS = [
+	"tokensRevokedAt",
+	"role",
+	"banned",
+	"banReason",
+	"banExpires",
+] as const;
+
+export function userUpdateGuard<T>(data: T): { data: T } {
+	if (!data || typeof data !== "object") return { data };
+	const present = PROTECTED_FIELDS.filter(
+		(field) => (data as Record<string, unknown>)[field] !== undefined,
+	);
+	if (present.length > 0) {
+		throw new APIError("BAD_REQUEST", {
+			message: `These fields cannot be changed here: ${present.join(", ")}.`,
+		});
+	}
+	return { data };
+}

package/template/src/middlewares/admin.ts

@@ -0,0 +1,46 @@
+import { createMiddleware } from "@tanstack/react-start";
+import { eq } from "drizzle-orm";
+import { user } from "@/db/schema";
+import { HttpError } from "@/utils/api-error";
+import { protectedMiddleware } from "./protected";
+
+function forbidden() {
+	return new HttpError({
+		status: 403,
+		error: "forbidden",
+		message: "Forbidden",
+	});
+}
+
+async function can(
+	// biome-ignore lint/suspicious/noExplicitAny: middleware context is framework-typed
+	context: any,
+	permissions: Record<string, string[]>,
+): Promise<boolean> {
+	const [currentUser] = await context.db
+		.select({ role: user.role })
+		.from(user)
+		.where(eq(user.id, context.session.user.id))
+		.limit(1);
+	const res = await context.auth.api.userHasPermission({
+		body: { role: currentUser?.role ?? "user", permissions },
+	});
+	return Boolean(res?.success);
+}
+
+/** Admin console gate: roles holding `config:manage` (admin / superadmin). */
+export const adminMiddleware = createMiddleware()
+	.middleware([protectedMiddleware])
+	.server(async ({ next, context }) => {
+		if (!(await can(context, { config: ["manage"] }))) {
+			throw forbidden();
+		}
+		// Preserve db + auth from parent middleware (do not drop them).
+		return next({
+			context: {
+				session: context.session,
+				db: context.db,
+				auth: context.auth,
+			},
+		});
+	});

package/template/src/middlewares/auth-rate-limit.ts

@@ -0,0 +1,37 @@
+import { env } from "cloudflare:workers";
+import { createMiddleware } from "@tanstack/react-start";
+import { authRateLimitKey } from "@/services/auth-rate-limit";
+
+// Brute-force / abuse throttle for the sensitive Better Auth endpoints. Better
+// Auth's own limiter is an in-memory Map — per Worker isolate on Cloudflare, so
+// it never aggregates into a global limit. This uses the Workers Rate Limiting
+// binding (AUTH_RATE_LIMITER), which is shared across isolates in a location and
+// strongly consistent. Only enforced when deployed; a no-op locally / if the
+// binding is absent (env.AUTH_RATE_LIMITER undefined). `env` is referenced only
+// inside .server() so it's stripped from the client bundle.
+export const authRateLimitMiddleware = createMiddleware().server(
+	async ({ next, request }) => {
+		const limiter = (
+			env as {
+				AUTH_RATE_LIMITER?: {
+					limit: (o: { key: string }) => Promise<{ success: boolean }>;
+				};
+			}
+		).AUTH_RATE_LIMITER;
+		const key = limiter ? authRateLimitKey(request) : null;
+		if (limiter && key) {
+			const { success } = await limiter.limit({ key });
+			if (!success) {
+				return Response.json(
+					{
+						status: 429,
+						error: "rate_limited",
+						message: "Too many requests. Please try again shortly.",
+					},
+					{ status: 429, headers: { "Retry-After": "60" } },
+				);
+			}
+		}
+		return next();
+	},
+);

package/template/src/middlewares/better-auth.ts

@@ -0,0 +1,15 @@
+import { createMiddleware } from "@tanstack/react-start";
+import { createAuth } from "@/lib/auth";
+import { databaseMiddleware } from "./database";
+
+export const betterAuthMiddleware = createMiddleware()
+	.middleware([databaseMiddleware])
+	.server(({ next, context }) => {
+		const auth = createAuth(context.db);
+
+		return next({
+			context: {
+				auth,
+			},
+		});
+	});

package/template/src/middlewares/body-limit.ts

@@ -0,0 +1,62 @@
+import { createMiddleware } from "@tanstack/react-start";
+import {
+	BodyTooLargeError,
+	readTextCapped,
+	UnsupportedMediaTypeError,
+} from "@/utils/body-limit";
+
+/**
+ * Generous for a JSON callback, small enough that an unauthenticated caller
+ * cannot spend the Worker's memory at will.
+ */
+export const MAX_WEBHOOK_BODY_BYTES = 64 * 1024;
+
+/**
+ * Read the request body once, behind a hard cap, and expose the capped raw
+ * string as `context.rawBody`.
+ *
+ * Raw text rather than parsed JSON on purpose: webhooks verify signatures over
+ * the exact characters received, so re-serialising would break verification.
+ * Handlers that want an object parse `context.rawBody` themselves.
+ *
+ * This is a *route* middleware, so a refusal is a returned `Response` — the
+ * `HttpError` rule in `utils/api-error` covers server-function middleware,
+ * where a returned Response would be stamped as data. Same reason
+ * `auth-rate-limit` answers 429 the same way.
+ */
+export function bodyLimitMiddleware(maxBytes: number) {
+	return createMiddleware().server(async ({ request, next }) => {
+		let rawBody: string;
+		try {
+			rawBody = await readTextCapped(request, { maxBytes });
+		} catch (error) {
+			if (error instanceof BodyTooLargeError) {
+				return Response.json(
+					{
+						status: 413,
+						error: "payload_too_large",
+						message: error.message,
+					},
+					{ status: 413 },
+				);
+			}
+			if (error instanceof UnsupportedMediaTypeError) {
+				return Response.json(
+					{
+						status: 415,
+						error: "unsupported_media_type",
+						message: error.message,
+					},
+					{ status: 415 },
+				);
+			}
+			throw error;
+		}
+		return next({ context: { rawBody } });
+	});
+}
+
+/** The cap on a public, unauthenticated payment webhook. */
+export const webhookBodyLimitMiddleware = bodyLimitMiddleware(
+	MAX_WEBHOOK_BODY_BYTES,
+);

package/template/src/middlewares/database.ts

@@ -0,0 +1,13 @@
+import { env } from "cloudflare:workers";
+import { createMiddleware } from "@tanstack/react-start";
+import { createDB } from "@/db";
+
+export const databaseMiddleware = createMiddleware().server(({ next }) => {
+	const db = createDB(env.HYPERDRIVE);
+
+	return next({
+		context: {
+			db,
+		},
+	});
+});

package/template/src/middlewares/protected.ts

@@ -0,0 +1,45 @@
+import { createMiddleware } from "@tanstack/react-start";
+import { withRlsUser } from "@/db/helper";
+import { HttpError } from "@/utils/api-error";
+import { betterAuthMiddleware } from "./better-auth";
+
+function unauthorized() {
+	return new HttpError({
+		status: 401,
+		error: "unauthorized",
+		message: "Authentication required.",
+	});
+}
+
+/** Require login; leave db as the raw connection (no user RLS transaction). */
+export const sessionMiddleware = createMiddleware()
+	.middleware([betterAuthMiddleware])
+	.server(async ({ next, context, request }) => {
+		const session = await context.auth.api.getSession({
+			headers: request.headers,
+		});
+
+		if (!session?.user) throw unauthorized();
+
+		return next({ context: { session } });
+	});
+
+/** Require login and run the handler inside a user-scoped RLS transaction. */
+export const protectedMiddleware = createMiddleware()
+	.middleware([betterAuthMiddleware])
+	.server(async ({ next, context, request }) => {
+		const session = await context.auth.api.getSession({
+			headers: request.headers,
+		});
+
+		if (!session?.user) throw unauthorized();
+
+		return withRlsUser(context.db, session.user.id, (tx) =>
+			next({
+				context: {
+					db: tx,
+					session,
+				},
+			}),
+		);
+	});